Dump Flash Memory with SPI from SPANSION FL016KIF

Question

I have a SPANSION FL016KIF (pinout on p.12) on a board and I want to dump the data. I try to use the BusPirate v3 for that.

I want to do this in-circuit. I didn't connect WP# and HOLD#.

This is the command transcript I used to set it up (I also tried other variations):

HiZ>m
1. HiZ
2. 1-WIRE
3. UART
4. I2C
5. SPI
6. 2WIRE
7. 3WIRE
8. LCD
9. DIO
x. exit(without change) 
(1)>5

Set speed:
 1. 30KHz
 2. 125KHz
 3. 250KHz
 4. 1MHz

(1)>3
Clock polarity:
 1. Idle low *default
 2. Idle high

(1)>1
Output clock edge:
 1. Idle to active
 2. Active to idle *default

(2)>2
Input sample phase:
 1. Middle *default
 2. End

(1)>1
CS:
 1. CS
 2. /CS *default

(2)>2
Select output type:
 1. Open drain (H=Hi-Z, L=GND)
 2. Normal (H=3.3V, L=GND)

(1)>2
Ready
SPI>W
Power supplies ON

And this is the instruction I try to execute, which should get some device information:

SPI>[ 0x9f r:4]
/CS ENABLED
WRITE: 0x9F
READ: 0x00 0x00 0x00 0x00
/CS DISABLED
SPI>

Unfortunately I only get zeros READ: 0x00 0x00 0x00 0x00. How can I figure out the correct settings for SPI? Are there other pitfalls?

Answer 1

Is the board powered? Obviously the chip needs power to be able to read out. The problem with doing this while it's still on the board is that other logic might be trying to access your chip at the same time.

All I can recommend is removing it from the board and powering the chip using your programmer (I don't know if the bus pirate is capable of doing this). I've read out a handful of chips via SPI in the past (Using a dataman programmer) and never had it working while still on the board. As a none electronics expert I expect there's some stuff on the board keeping certain pins of your chip at 0 or 1 while you want them to alternate. This might be due to some pull-up/pull-down resistors somewhere in the circuit or something like that.

Seeing how this is an edge packaged chip it shouldn't be too hard to remove with basic soldering skills. Especially seeing how you're already capable of soldering the wires on it. If you've never removed some before then what I can say is; Heat up the pins on 1 edge and push some tweezers under the chip to lift up the chip on 1 side. Then repeat on the other side. These packages are quite flexible and it won't break your pins. Just don't exaggerate the lifting ;)

Answer 2

First off, I would suggest ensuring that the HOLD# pin is pulled high. If it is not, the chip is in a "paused" state and you won't be able to read from it.

I've dumped several SPI chips while they were in circuit and the most common problem that I've run into is that the power rail that the chip is powered from on the PCB is probably powering other components as well. This poses two potential problems:

1. Your power supply may not be capable of providing enough current to power everything on the power rail, and thus you aren't providing enough power to the SPI flash chip,

2. even if you can provide enough power, other parts of the circuit may be trying to communicate with the SPI chip too, which will obviously cause problems.

My solution to this is to carefully desolder the power pin (pin 8) and bend it up so that it is not touching the solder pad. This way you can provide power to only the flash chip and not to the rest of the circuit.

Finally, sometimes there are other components on the board that can interfere with communicating with the flash chip, so if you still have problems you should just desolder the whole chip. As @justsome mentioned, this is actually not difficult, especially for these IC packages.

Answer 3

Flashrom project has some advice on ISP (In-System Programming) of SPI chips. For example:

Often parts of the chipset are powered on partially (by the voltage supplied via the Vcc pin of the flash chip). In that case disconnect Vcc from the programmer and power it with its normal PSU and try powering up the board normally and holding it in reset (e.g. use a jumper instead of the reset push button).

Try the tips given on that page.